SpectralTrojan: psychoacoustically constrained frequency-domain backdoors for keyword spotting and speaker identification
- 1Wendeng District Housing and Urban-Rural Development
- 2University of Science and Technology of China
Abstract
Voice AI pipelines remain vulnerable to training-phase backdoor attacks, but the relevant tasks must be distinguished carefully. This study evaluates keyword spotting (KWS) and closed-set speaker identification (SI); it does not evaluate automatic speech transcription or speaker verification. We introduce SpectralTrojan, a frequency-domain backdoor that distributes low-energy trigger components over model-sensitive frequency regions while constraining them by the reported static psychoacoustic threshold. The revision explicitly analyzes architectural mismatch between the surrogate heatmap model and the victim model, states that the archived experiments do not establish inaudibility during quiet or silent speech intervals, and clarifies the capability boundary between data-only poisoning and full outsourced training. Across the digital KWS and SI settings reported in the original study, SpectralTrojan achieves attack success rates (AtkSR) above 98.2% with clean accuracy degradation no larger than 1.75%. Existing cross-architecture results show practical transfer, but they do not establish that surrogate-selected frequency bands are universally optimal; the revised paper therefore introduces heatmap-overlap and transfer-regret diagnostics and softens the corresponding claim. Acoustic robustness is evaluated through room-impulse-response and device simulation. Because the original records do not contain auditable microphone, loudspeaker, room-reverberation, and background-noise metadata, the unsupported hardware-specific over-the-air claim has been removed. The revision further clarifies coefficient selection, embedding-space diagnostics, and the distinct feasibility assumptions of the two attack surfaces.
Related
- Reaction time-related compression underlies overestimation of time-constrained reachability
- Surveillance of Athletes’ Health in Resource-Constrained African Sports Contexts: Why Context Matters and Time To Catch Up
- Hidden labor, monitoring, and exit burdens after hospital operational AI deployment: implications for resource-constrained Chinese hospitals
- Managing Severe Proximal Femoral Fibrous Dysplasia in a Young Adult Using Hemiarthroplasty in a Resource-Constrained Healthcare System: A Case Report
- Dopamine Metabolism as a Chemically Constrained Network: Structural Regulation, Redox Liability and Dopaminergic Vulnerability in Parkinson’s Disease
BibTeX
@article{lyu2026spectraltrojan,
title = {{SpectralTrojan: psychoacoustically constrained frequency-domain backdoors for keyword spotting and speaker identification}},
author = {Yongsheng Lyu and Chao Lyu},
journal = {Scientific Reports},
year = {2026},
month = aug,
doi = {10.1038/s41598-026-65973-9},
url = {https://doi.org/10.1038/s41598-026-65973-9},
note = {CC BY},
}
RIS
TY - JOUR
TI - SpectralTrojan: psychoacoustically constrained frequency-domain backdoors for keyword spotting and speaker identification
AU - Yongsheng Lyu
AU - Chao Lyu
PY - 2026
DA - 2026/08/01
JO - Scientific Reports
DO - 10.1038/s41598-026-65973-9
UR - https://doi.org/10.1038/s41598-026-65973-9
AB - Voice AI pipelines remain vulnerable to training-phase backdoor attacks, but the relevant tasks must be distinguished carefully. This study evaluates keyword spotting (KWS) and closed-set speaker identification (SI); it does not evaluate automatic speech transcription or speaker verification. We introduce SpectralTrojan, a frequency-domain backdoor that distributes low-energy trigger components over model-sensitive frequency regions while constraining them by the reported static psychoacoustic threshold. The revision explicitly analyzes architectural mismatch between the surrogate heatmap model and the victim model, states that the archived experiments do not establish inaudibility during quiet or silent speech intervals, and clarifies the capability boundary between data-only poisoning and full outsourced training. Across the digital KWS and SI settings reported in the original study, SpectralTrojan achieves attack success rates (AtkSR) above 98.2% with clean accuracy degradation no larger than 1.75%. Existing cross-architecture results show practical transfer, but they do not establish that surrogate-selected frequency bands are universally optimal; the revised paper therefore introduces heatmap-overlap and transfer-regret diagnostics and softens the corresponding claim. Acoustic robustness is evaluated through room-impulse-response and device simulation. Because the original records do not contain auditable microphone, loudspeaker, room-reverberation, and background-noise metadata, the unsupported hardware-specific over-the-air claim has been removed. The revision further clarifies coefficient selection, embedding-space diagnostics, and the distinct feasibility assumptions of the two attack surfaces.
SN - 2045-2322
ER -